Unescaped Output in Enable Media Replace Error View

Enable Media Replace up to and including 4.1.8 printed the error message and error description into the error view without HTML escaping. Upstream added esc_html() to both outputs in 4.1.9. The values originate from a fixed set of plugin-supplied translated strings, so this is defence-in-depth hardening rather than a reachable injection point.... Weiterlesen